GitHub Repo

Analytics Story: Office 365 Account Takeover

Updated Date: 2026-05-13 ID: 7dcea963-af44-4db7-a5b9-fd2b543d9bc9 Author: Mauricio Velazco, Patrick Bareiss, Splunk Product: Splunk Enterprise Security

Description

Monitor for activities and anomalies indicative of initial access techniques within Office 365 environments.

Why it matters

Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. O365's centralized storage of sensitive data and widespread adoption make it a key asset, yet also a prime target for security threats. The "Office 365 Account Takeover" analytic story focuses on the initial techniques attackers employ to breach or compromise these identities. Initial access, in this context, consists of techniques that use various entry vectors to gain their initial foothold . Identifying these early indicators is crucial for establishing the first line of defense against unauthorized access and potential security incidents within O365 environments.

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
O365 Email Suspicious Behavior Alert Email Forwarding Rule TTP
O365 Multiple Failed MFA Requests For User Multi-Factor Authentication Request Generation TTP
O365 SharePoint Suspicious Search Behavior Sharepoint, Unsecured Credentials Anomaly
O365 User Consent Denied for OAuth Application Steal Application Access Token TTP
O365 Excessive SSO logon errors Modify Authentication Process Anomaly
O365 Security And Compliance Alert Triggered Cloud Accounts TTP
O365 Email Suspicious Search Behavior Remote Email Collection, Unsecured Credentials Anomaly
O365 Multi-Source Failed Authentications Spike Password Spraying, Credential Stuffing, Cloud Accounts Hunting
O365 Email Hard Delete Excessive Volume Clear Mailbox Data, Data Destruction Anomaly
O365 Mail Permissioned Application Consent Granted by User Steal Application Access Token TTP
O365 Email Transport Rule Changed Email Forwarding Rule, Email Hiding Rules Anomaly
O365 SharePoint Malware Detection Malicious File TTP
O365 Email Access By Security Administrator Remote Email Collection, Exfiltration Over Web Service TTP
O365 BEC Email Hiding Rule Created Email Hiding Rules TTP
High Number of Login Failures from a single source Password Guessing Anomaly
O365 Multiple OS Vendors Authenticating From User Brute Force TTP
O365 Multiple AppIDs and UserAgents Authentication Spike Valid Accounts Anomaly
O365 User Consent Blocked for Risky Application Steal Application Access Token TTP
O365 Service Principal Privilege Escalation Additional Cloud Roles TTP
O365 High Number Of Failed Authentications for User Password Guessing TTP
O365 File Permissioned Application Consent Granted by User Steal Application Access Token TTP
O365 Email Password and Payroll Compromise Behavior Clear Mailbox Data, Local Email Collection, Data Destruction TTP
O365 Email Receive and Hard Delete Takeover Behavior Clear Mailbox Data, Local Email Collection, Data Destruction Anomaly
O365 Excessive Authentication Failures Alert Brute Force Anomaly
O365 Email Security Feature Changed Disable or Modify Cloud Log TTP
O365 Multiple Users Failing To Authenticate From Ip Password Spraying, Credential Stuffing, Cloud Accounts TTP
O365 Email Send and Hard Delete Suspicious Behavior Clear Mailbox Data, Local Email Collection, Data Destruction Anomaly
O365 Email Send Attachments Excessive Volume Clear Mailbox Data, Data Destruction Anomaly
O365 Safe Links Detection Spearphishing Attachment TTP
O365 Exfiltration via File Sync Download Data from Cloud Storage, Exfiltration Over Web Service Anomaly
O365 Threat Intelligence Suspicious File Detected Malicious File TTP
O365 Email Send and Hard Delete Exfiltration Behavior Clear Mailbox Data, Local Email Collection, Data Destruction Anomaly
O365 Concurrent Sessions From Different Ips Browser Session Hijacking TTP
O365 Exfiltration via File Download Data from Cloud Storage, Exfiltration Over Web Service Anomaly
O365 Exfiltration via File Access Data from Cloud Storage, Exfiltration Over Web Service Anomaly
O365 Block User Consent For Risky Apps Disabled Disable or Modify Tools TTP

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
Office 365 Universal Audit Log Other o365:management:activity o365
O365 UserLoginFailed Other o365:management:activity o365
O365 Other o365:management:activity o365
O365 Consent to application. Other o365:management:activity o365
O365 UserLoggedIn Other o365:management:activity o365
O365 Add app role assignment grant to user. Other o365:management:activity o365
Office 365 Reporting Message Trace Other o365:reporting:messagetrace o365
O365 Update authorization policy. Other o365:management:activity o365

References

Source: GitHub | Version: 2